0

My company is delivering email out of an ec2 instance using Postfix, but messages are sent to the spam folder in all major providers (Gmail, Outlook, Yahoo). We have an EIP associated with this instance, and rDNS has been properly configured using the Amazon request form (this was done a little over a week ago, so updates that Amazon supposedly makes to the DNSBL services should have propagated). I've searched mxtoolbox and other tools to confirm that this IP address is not blacklisted and that the reputation is neutral. Spam Assassin gives the message contents a perfect score. In addition, SPF, DKIM, and DMARC are set up and passing and we are using TLS with a valid cert.

Here are the headers:

Delivered-To: xxx@gmail.com
Received: by 2002:a4a:b041:0:0:0:0:0 with SMTP id g1csp4098996oon;
        Mon, 24 Jun 2019 08:05:40 -0700 (PDT)
X-Google-Smtp-Source: APXvYqzZndWhZBsN29EhNOp1aagTj5c5ebPVO6xY3MfTwaKYm3AvCwzwqx43rzUqhGhMDPvEHN/Y
X-Received: by 2002:a17:902:aa8a:: with SMTP id d10mr111419846plr.159.1561388740870;
        Mon, 24 Jun 2019 08:05:40 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1561388740; cv=none;
        d=google.com; s=arc-20160816;
        b=WNFL3Vh4gd24QFNlfnPrBq3+82t33Hs10Rpk8KA8/FRU+MQQ3dDZCaG9Glw6bZhyHV
         gff4qNZjwcoUnPLvkZdFlD9y6b9xa2sM7K8V419EfsOPk3n8Ny+L4/CGyo4SdAUaaD6x
         GosTw29PdX+A2c+tHO8DXbqXQ4oNjBXoWKvsBdyi36OZ9o2l1jm3j7Yc10H8Q9Tq7oWf
         ChsALISiOT6n0i/P+NmpKX9vVWOsEjFfPilK2DQmO9Gb49PKMCQNkvsy+7poNljccFLp
         +pNLeRbVbVlv/HUy9UkGeT0ODD/gOpS7X2fkrSf6oXrfFf3hzahbWJWBEy11M7QTDciG
         ZK1Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=dkim-signature:content-transfer-encoding:mime-version:subject
         :message-id:to:from:date;
        bh=UpxxmjO04XKymFt9ExFCb11J8a08/pGBjmnN3qdQWMI=;
        b=Ot2pOw+u2yhiQybhndBPuJ8UxZbdV+loMcmd/fFkC5X6IPujvV8wA2CbV6LABYQCoW
         Qe5lZyazF/J2uZ/x4WBk0nONiqhpI+Tdanc7+vZP1UbnMid/kWnhfvo/bv4BhjB/L94f
         yDcfnknk2cMDGrKiQBuDGqKvD3gqO2YueuNiHhKrbM8bMMdXXjTynRXRRmeV0z4cYVc6
         XL9s1LdXSTSccplRdvK3xdE1UuXo0WgA9qWHh/1EOTfQDs31cqmm/CX5+YDcx0j6u2Db
         PDeaw5aOiOOggSqqFfEYDcbwjkq3Yk4lVU7bk43VdNWaXda1i9vVbhM0OPA3rjC5xVyn
         fEpA==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@sender.com header.s=ps header.b=lH0AIQjr;
       spf=pass (google.com: domain of bounce+ps_5d10e6c3e59e3_663a025f87942as1mail@mailer.sender.com designates 1.2.3.4 as permitted sender) smtp.mailfrom=bounce+ps_5d10e6c3e59e3_663a025f87942as1mail@mailer.sender.com;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=sender.com
Return-Path: <bounce+ps_5d10e6c3e59e3_663a025f87942as1mail@mailer.sender.com>
Received: from 5f08050601590557.smtp.sender.com (5f08050601590557.smtp.sender.com. [1.2.3.4])
        by mx.google.com with ESMTPS id t5si10353297pgv.164.2019.06.24.08.05.40
        for <xxx@gmail.com>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Mon, 24 Jun 2019 08:05:40 -0700 (PDT)
Received-SPF: pass (google.com: domain of bounce+ps_5d10e6c3e59e3_663a025f87942as1mail@mailer.sender.com designates 1.2.3.4 as permitted sender) client-ip=1.2.3.4;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@sender.com header.s=ps header.b=lH0AIQjr;
       spf=pass (google.com: domain of bounce+ps_5d10e6c3e59e3_663a025f87942as1mail@mailer.sender.com designates 1.2.3.4 as permitted sender) smtp.mailfrom=bounce+ps_5d10e6c3e59e3_663a025f87942as1mail@mailer.sender.com;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=sender.com
Date: Mon, 24 Jun 2019 15:05:39 +0000
From: Sender <donotreply@sender.com>
To: xxx@gmail.com
Message-ID: <ps_5d10e6c3e59e3_663a025f87942as1mail@mailer.sender.com>
Subject: Account Successfully Provisioned
Mime-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sender.com; q=dns/txt; s=ps; t=1561388740; bh=UpxxmjO04XKymFt9ExFCb11J8a08/pGBjmnN3qdQWMI=; h=date:from:to:message-id:subject:mime-version:content-type:content-transfer-encoding; b=lH0AIQjrRq7hs3mRNhwakT1vZArNTaqzm9CAkXiqBkXHodfuvovyr/H7jqCvRasK3gx7Iq+Lp4FabO6ZbNsw63eViS11YaTioCeficmrDX102QJaEHmWHEhTYfZeCwSVeN2lpL/zxZ65V9KpxOhZUaEyR0aqO4yXHTRllQNzez0=

I've replaced the actual domain and IP with sender.com/1.2.3.4.

Any ideas of what could be going wrong or what we can do to stop our messages being marked as spam? Now that AWS has a Bring-Your-Own-Ip service, we could associated a /24 with our account and start sending emails through our own IP's, but I'm not sure how much that would help?

Update: In Gmail, the the error message is the following:

This message seems dangerous

Similar messages were used to steal people's personal information. Avoid clicking links, downloading attachments, or replying with personal information.

The contents of the email is just:

Hello,

Your account has been successfully provisioned. To access your account, <a href="linkhere">sign in here.</a>

Would the fact that we've only sent low volume emails to internal employees with this IP (thus far) affect the IP reputation? If so, what can we do to improve reputation?

  • Log in to Gmail and view the message. There will be a notice above the message that tells you why it was marked as spam. – Michael Hampton Jun 24 at 16:36
  • Thanks. Just made a quick edit with the error message. – Billy Shears Jun 24 at 18:35
  • Yeah, linkhere does look a bit fishy. – Michael Hampton Jun 25 at 1:25
  • What does "linkhere" look like? Do you use your own domain or does it point to something like an EC2 hostname? – omniomi Jun 25 at 15:41
  • It points to our own domain. So something like https://www.example.com/organizations/sign_in. The domain is hosted on an ec2 instance, but we don't link to the ec2 hostname. – Billy Shears Jun 25 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.